Debtors City of York Council Internal Audit Report 2017/18

Business Unit: Customer and Corporate Services Responsible Officer: AD, Customer Services and Digital Service Manager: Head of Customer, Resident and Exchequer Services Date Issued: 14th May 2018 Status: Final Reference: 10190/008

| | P1 | P2 | P3 | |---|----|----|----| | Actions | 0 | 0 | 5 | | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction The Debtors team sits within the Directorate of Customer and Corporate Services, and is responsible for:

- issuing invoices to customers for services provided by the council;
- taking recovery action to ensure invoices are paid;
- ensuring payments received are correctly recorded in the debtors system on Authority Financials.

In 2016/17 there were approximately 40k invoices issued, with a total value of just over £73m.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that:

- Systems comply with the council's financial regulations, relevant legislation, and other appropriate guidance;
- Accounts are raised promptly and accurately to notify customers of any amounts due;
- Income is correctly credited to customers' accounts;
- Appropriate action, including write off of debts, is undertaken to recover debts where invoices are not paid within specified timescales;
- Performance is monitored and effectively managed.

The council is continuing to collect monies on behalf of the Business Improvement District, using the council's debtor invoice system. The audit has confirmed that the procedures involved in raising these invoices are adequate and appropriate.

Council tax collection has not been covered by this audit, as it is covered in detail in the 2017/18 audit of Council Tax & NNDR.

Key Findings There are Financial Regulations set for the council with coverage of the debtor system. There are additional supplementary policies specific to the debtor process and these comply with the Financial Regulations. There are also guidance notes available on the intranet, to help staff follow any parts of the system that may not be clear. In general, some policies and procedural notes are outdated and need to be reviewed. The Corporate Debt policy had been reviewed and updated in November 2016 and the Income Policy in October 2015. At the time of the audit they were not available on the intranet but have subsequently been added and are now available to all staff. Invoices are generally raised accurately and promptly; with good detail. There were some instances where invoices were raised a long time after service delivery and some were raised without a service delivery date. There was not always evidence of appropriate authorisation for the raising of credit notes.

Receiving and crediting of income to customer accounts was audited as part of the Financial Transactions and Income Management audit 2017/18 and an opinion of High Assurance was given when it was finalised in February 2018.

Overall, there is a good recovery system in place that deals with outstanding invoices both promptly and effectively. There was evidence of authorisation for write offs and the reasons debts were written off, showing this was only done after all reasonable recovery action had been taken. Write offs had been authorised by the Head of Customer, Resident and Exchequer Services and email evidence was provided that showed the Chief Finance Officer had delegated this authority. The directorate scheme of delegation was under review at the time of the audit and now been completed. It clearly sets out the delegation of authority for write offs to the Head of Customer, Resident and Exchequer Services.

There is some performance management in place within the department, with evidence to suggest that this is shared with management.

**Overall Conclusions**

It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance.

## 1 Income Policy not up to date

| Issue/Control Weakness | Risk | |------------------------|------| | The Income Policy has not been reviewed since 2015 and the latest version was not available on the intranet at the time of the audit. | Policies may be inaccurate and not reflective of current activities. |

### Findings

There is an Income Policy available. This document outlines how procedures should be carried out within the council, to ensure charges, income and debt recovery are managed properly. However, this policy has not been reviewed since 2015. The policy states that the document will be reviewed and updated on an annual basis; this has not been adhered to and there is a risk that policies may become outdated and inaccurate.

### Agreed Action 1.1

The October 2015 version of the Income Policy is now available on the intranet. The Policy will be reviewed and updated if necessary. The updated policy will be uploaded to the intranet to ensure it is accessible to all members of staff across the council.

| Priority | 3 | |----------|---| | Responsible Officer | Head of Corporate Finance & Commercial Procurement Manager | | Timescale | December 2018 | 2 Refund Policy

| Issue/Control Weakness | Risk | |------------------------|------| | There is no formal refund policy or procedure. | Refunds are not issued when appropriate. |

Findings

There is no formal refund policy or procedure in place. The general rules adhered to by the debtors team include offsetting credit to the next invoice in the form of a credit note or refunds in the circumstances where future invoices are unlikely. Credit notes and refunds issued within social care debts are dealt with differently to sundry debts; often causing a longer period between debt and credit in social care cases.

Although this process seems to be working well, having no procedure notes in place leaves this element of the system exposed to risk. Therefore, a procedure document should be put in place to ensure that all members of staff are aware of the refund and credit note process.

Agreed Action 2.1

A draft refund policy, addressing the weaknesses identified, will be presented to DMT. Once approved, this policy will be adopted and used within the council.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Income Services Operations Manager | June 2018 |

### 3 Date of Service

| Issue/Control Weakness | Risk | |------------------------|------| | Invoices do not always state when services were provided. | Invoices without service date may be challenged. |

#### Findings

Invoices to customers should contain a clear description of what services were delivered and when they were delivered.

Invoices did contain detailed narratives that clearly explained the services that had been delivered. However, over a quarter of the invoices tested did not state the date that the services were delivered.

#### Agreed Action 3.1

Invoices will now be monitored by the customer accounts team and where problems are identified, staff will be issued with further training and, if necessary, will have access restricted.

| Priority | 3 | |----------|---| | Responsible Officer | Income Services Operations Manager | | Timescale | June 2018 | 4 Timeliness of Invoice

| Issue/Control Weakness | Risk | |------------------------|------| | The timeliness in issuing invoices is inconsistent and sometimes significantly delayed. | Delay in income recovery for services delivered. |

Findings

There was a large variation, in the length of time between delivery date and invoice date, across the sample of invoices tested. Two were raised four months after service and a further five were raised a month after service delivery.

The service advised that the date an invoice can be raised relies on the type of service and time needed to gather the information needed in order to invoice. It is accepted that some delays cannot be avoided. However, delays in invoicing for services increases the risks that invoices will not be paid promptly and is also not good customer service. Guidance and reminders should be given to services raising invoices that they should do so as soon as possible after services have been delivered.

Agreed Action 4.1

This is primarily the responsibility of the service areas raising invoices. The customer account team will monitor the timeliness of invoices and liaise with appropriate services to ensure that they are following correct procedure and give reminders about raising invoices in a timely manner.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Income Services Operations Manager | June 2018 | 5 Authorisation of Credit Notes

| Issue/Control Weakness | Risk | |------------------------|------| | Some credit note pro-forma sheets are not authorised with a signature. | Credit notes are issued without appropriate authorisation. |

Findings

Credit notes are raised by the customer accounts team on receipt of a proforma from directorate staff, which details the invoice the credit note is needed for, the amount to be credited and the reasons for the credit or cancellation of the invoice. This proforma needs to be authorised by the budget holder.

Pro-formas were available for the credit notes tested and they contained explanations of the reasons for the credit note. However, six of twenty credit note pro-forma sheets tested did not have any authorising signature.

Agreed Action 5.1

Proformas for credit notes and cancellations are primarily sent electronically and are not usually signed as hard copy documents. The customer account team will scan the original email to ensure that there is sufficient evidence to support credit notes and cancellations.

| Priority | 3 | |----------|---| | Responsible Officer | Income Services Operations Manager | | Timescale | June 2018 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.